ClawHub
Back to skill

Security audit

patent-family-analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent patent-analysis helper that fetches patent-family data through a disclosed PatSnap MCP integration and writes a local HTML report.

Install this only if you are comfortable using a PatSnap/Zhihuiya MCP-backed workflow and having patent queries and results used to generate a local HTML report. Review generated reports before sharing them, especially if the patent search topic or analysis is confidential.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill explicitly instructs the agent to generate a complete HTML report file and store it under a session path, which implies file-write capability, yet no declared permissions are present. Undeclared file I/O weakens transparency and policy enforcement because users and the platform may not realize the skill can create local artifacts.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill directs the agent to write a report to disk without an explicit user-facing warning or confirmation step. Silent file creation can surprise users, clutter storage, or create data-handling concerns, especially if reports contain sensitive search topics or derived analysis.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.